Full Breakdown
PHP2Shell: AI-Accelerated Discovery Triggers Global Patch Race
By Drooid · · How we work
Core Event – Critical PHP Vulnerabilities Exposed
Two remote-code-execution flaws in PHP, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), let unauthenticated attackers run arbitrary code on unpatched servers. Researchers at Calif identified the bugs in early August 2024; AI-assisted techniques made them exploitable in 2026. The PHP Foundation released patches in late October 2026, ending the embargo.
Background & Context
PHP powers roughly 70 % of web-facing sites, including WordPress and Drupal. Its memory-unsafe codebase has long attracted remote exploits. Calif’s work, part of OpenAI’s “Patch the Planet” program with cloud-security firm Wiz, used frontier AI models to craft proof-of-concept exploits.
Timeline
- Early August 2024 – Calif discovers the flaws.
- October 17 2026 – Amazon reports evidence of exploitation before public patches.
- Late-October 2026 (Wednesday) – PHP Foundation publishes patches.
- October 21 2026 – Smartschool platform scheduled to go offline.
Data & Statistics
- 70 % of web-facing services rely on PHP.
- Cloudflare recorded millions of exploitation attempts within hours of disclosure.
- NSA estimates about 75 % of actively exploited vulnerabilities are memory-related.
Official Statements & Responses
- The PHP Foundation said the embargo let major providers apply fixes before public release.
- Amazon warned attackers may have accessed the bugs a week earlier, urging checks for activity dating back to October 17.
- Matthew Prince of Cloudflare noted a sharp surge in attempts after disclosure.
- The NSA urged migration toward memory-safe languages such as Python, Rust and Swift.
On-the-Ground Reports
Banks, retailers, gaming sites, hospitals and several government agencies temporarily shut down or isolated PHP-based services to apply patches. The Smartschool platform in Edegem was slated for offline status by October 21.
Conflicting Reports & Gaps
- Amazon detected exploitation a week before patches, suggesting independent or early-leak access.
- The PHP Foundation blamed a single company for publishing patches hours before the embargo ended, but this does not fully explain Amazon’s timeline.
- No mass-exploitation confirmed, though post-exploit activity indicates at least one targeted system was compromised.
Verbatim Quotes
- “No model is simply capable of unearthing ‘all bugs’ with simple prompts. At least for now,” — Calif.
- “It quietly powers online shops, news sites, school portals, and small-business pages,” — Martin Zugec, Bitdefender.
- “Because of this flaw you could be exposed to malware, data breaches, or scams based on data leaked from these sites,” — Cooper Quintin.
- “When researchers announce a flaw, they’re saying a type of lock can be picked,” — Martin Zugec, Bitdefender.
- “If you run your own blog or small-business website, it is imperative that you update immediately,” — Chris Fistonish, Malwarebytes.
- “They break into servers and later sell that access to other criminals, including ransomware gangs,” — Martin Zugec, Bitdefender.
What’s Next
Analysts expect AI-driven code analysis to keep surfacing hidden flaws in legacy software, shortening the discovery-to-exploit window. The NSA’s push for memory-safe languages points to a longer-term shift, but PHP’s extensive deployment means remediation will remain a priority for years.